What to do about doxxing, source by source

What counts as doxxing, and how bad it is

EFF describes doxxing as the deliberate sharing of personal information to harass or endanger someone. NYCLU describes the gathering and publication of personal information such as addresses and phone numbers by hostile parties. The FBI, in a footnote to its alert of 6 March 2025 about violent online networks, defines it as obtaining and publishing personally identifiable information on the internet, usually for malicious intent. Cybersmile and the Department of Homeland Security spell it “doxing”; Minc Law and most of the other sources use the double x.

The name is read as short for “documents”. Stanford IT writes “dropping documents”, Tufts “dropping dox (documents)”, and Cybersmile says the word comes from “documents” and emerged as a revenge tactic in 1990s hacking culture. Minc Law is more careful and says the practice “may have originated” from the phrase.

On how the details reach a stranger, the sources list several routes. Tufts says doxxers collect from publicly available sources, hack websites and companies that store your information, buy it from the dark web or data brokers, or compromise your accounts and networks. Minc Law lists tracking usernames across accounts, watching social media, phishing emails, data broker sites, and public or government records such as marriage licenses and birth certificates. EFF adds that public records, among them voter, property and business registration records, put the public interest in transparency against the risk of serious consequences when someone with ill intent reads them.

How serious a case is decides how much to do, according to Minc Law. If the information is not sensitive and there is no risk of physical or emotional harm, it says blocking the person and ignoring the posts may be enough, which denies a harasser the attention. If the information is sensitive and could expose you to harm, it says to consider contacting law enforcement or seeking legal action. Cybersmile puts the same test as a question: once you have some perspective, ask whether there is a real threat to your personal safety. The table below shows what Cybersmile says each kind of data is used for.

One case is different from the rest. Cybersmile says the threat of leaking personal information can be used to manipulate or blackmail someone into doing or saying things they do not want to, and the FBI alert describes networks that threaten to dox or swat their victims to force demands. If the message is a demand with a deadline, our page on blackmail and threats to share images sets out an order of moves for that case.

Keep a record before you touch anything

The sources do not agree on a first step, and the figure below sets four of them side by side. EFF opens with an incident log. Minc Law says the first step is to gather as much information as possible. Cybersmile opens with changing every password. Stanford IT lists six steps in a news item from 16 September 2024: a takedown request first, then “Document and preserve evidence”, then reports to law enforcement and safety groups, legal advice, delisting from directories and scrubbing your online data. The pages we read do not give an hour count for any of this. The order on this page is our choice, and the reasoning is ours, not a source’s: Cybersmile says platforms normally remove doxxing content “pretty quickly”, so a record made after a takedown may be harder to make, and we put the record first.

What goes in it is simple. EFF says the incident log does not need to be beautiful or complex: a place to note times, places, people and the general nature of what you see, helpful if law enforcement gets involved. Minc Law says to take a screenshot or download the page where the doxxing occurred, record the timestamp and URL, and save copies of harassing messages, and to do it even if you do not feel immediately threatened, because the doxxing could be the start of a larger attack. The FBI alert says that if you believe you are the victim of a crime using these tactics, you should retain all information, for example usernames, email addresses, websites or names of platforms, photos and videos. Google’s removal form asks for screenshots too, to help Google find the content.

EFF says responding to doxxing is “a team sport”. It suggests trusted people who watch the forums where the activity happens, keep the log up to date, set up web alerts and lock down social media accounts. For the forums it says to look privately, with the Tor browser, and not to engage with anyone there. It describes Google Alerts as a free service that tells you when a keyword such as your name is freshly indexed, notes that anonymous trolls may not trigger one, and advises leaving the alerts to a person you trust because updates can come often. Cybersmile gives the same reason for asking someone to monitor for you: another person takes the emotional strain.

Lock the doors: accounts, phone number and bank

Cybersmile says most breaches in personal security happen when passwords, social media accounts or email accounts are compromised, and tells you to change all your passwords immediately. EFF names the settings for the accounts you keep using: turn on two-factor authentication if it is not already on, switch social media accounts to private so that people must ask for access, and mute terms and block accounts to meet less stressful content. It adds that every app’s menu is different. In a prevention list, Tufts recommends an authenticator app instead of texts, phone calls or emails, a PIN for your SIM cards, and a password manager.

Closing an account is a choice EFF puts on the table. If an account is being targeted with hate, or signs point to one of your accounts as the source of information used against you, it says shutting it down may be the best decision for now, and that depending on the app the deletion may be temporary, so the account may be recoverable once things have cooled off.

The phone number and the bank are the third lock. EFF warns that the people doxxing you might try SIM swapping, contacting your cellular provider pretending to be you to hijack your number, and then pivot to other accounts you verify with your phone. It tells you to place a security password or PIN on the provider account and on the bank account if they offer one, says each provider names the feature differently, and links guides for Verizon, AT&T and T-Mobile. Our page on SIM swap explains the attack, and what a phone number alone can do covers the settings around it. If banking or card details were exposed, Cybersmile says to report that to your bank immediately because the bank can advise and secure the account, and Minc Law likewise says to contact your financial institutions and change passwords.

Get it taken down: platforms, Google, brokers and records

Cybersmile says doxxing breaches the terms of service of social media and blog platforms, which will normally suspend the account doing it and remove the content. For the list of places to contact, it suggests searching Google for keywords from your own personal information and compiling the platforms that turn up. Minc Law describes three platforms. It says Facebook does not use the word doxxing but treats sharing identifiable information about others as a violation of its community standards, that TikTok’s guidelines explicitly prohibit doxxing, and that Twitter, the name Minc Law still uses, lets you report a post and has a separate form. We did not read those platforms’ own rules, so this is Minc Law’s summary and not theirs. The pages we read do not say whether a platform tells the person who posted when you report.

Google’s help page, “Remove my private info from Google Search”, has a section headed “Report doxxing content”. Google says it can remove doxxing content as long as there is a URL with either of two things: your personal information along with explicit or implicit threats against you, including calls for others to harm or harass you, or a significant amount of aggregated personal information without a legitimate purpose. The form needs the URLs of the pages, and only those URLs are reviewed. The limit that matters most is stated plainly: Google can only remove things from its own search results, and to have something taken off the website that hosts it you contact the website’s owner.

Google describes two outcomes. With a full removal the page no longer shows up on Google Search. With a partial removal it does not show up for any search that contains your name or identifier, but it might show up for something else. If Google removes a result you get an email. Even then, it says the content might still be on the internet, found through links, social media or other search engines, and content about something important or newsworthy might not be taken down. The page gives no time for a decision. For contact details such as an address, phone number or email, Google points to its “Results about you” feature, which can also send notifications for new results. EFF’s separate note is about Google Alerts, a different service from “Results about you”, and says doxxing efforts by anonymous trolls may not trigger an alert.

Brokers and records feed the problem, and the sources treat them as part of the cleanup. Cybersmile names Whitepages, Spokeo and 192 as sellers of personal information and says you can usually ask for removal. EFF says a recent study found doing broker opt-outs yourself more effective than paid services, though it does not name the study in the text we read, and that a paid service may still be worth the money if you would rather have someone else do it. NYCLU points to Privacy Rights Clearinghouse for lists of brokers and opt-out instructions, and names DeleteMe as one commercial service while saying it endorses none. For public records, EFF says to ask the sites that republish them to take your information down, which does not remove the record but removes a layer of convenience, and that some states have Address Confidentiality Programs offering a proxy address. Stanford IT lists “Delist from directories” and “Scrub your online data” as its last two steps. Our page on the right to be forgotten covers the requests that go to organisations holding data and to search engines, and our digital footprint page collects the rest.

Who to tell: police, FBI, a lawyer, people you trust

The sources differ on the police. Minc Law says that if the information puts you in harm’s way, you should report to your local police with documentation, and that the FBI can be reached through its cyber crime unit. Cybersmile says to assess the threat and not be afraid to contact the authorities if you feel threatened. EFF is more guarded and writes that for many, talking to law enforcement will only make things worse. It still advises getting ahead of one tactic. SWATing, which EFF describes as calling the police on a target to bring them to the door, is often used in coordinated attacks, and if you think it is possible, EFF says telling law enforcement what you are dealing with may make officers less likely to arrive with guns drawn. The FBI alert defines swatting as false emergency calls meant to send armed police to an address.

For a crime of the kind the FBI alert describes, it names three ways to report after you keep everything: the Internet Crime Complaint Center at ic3.gov, your local FBI field office, or 1-800-CALL-FBI (225-5324). For an immediate, life-threatening emergency it says to dial 9-1-1. That alert is about violent online networks, not doxxing in general, so these are the channels it gives for those cases.

On lawyers, Minc Law, which sells these services, recommends a content removal attorney, and says removal can rest on privacy claims and a possible claim for intentional infliction of emotional distress. Stanford IT lists “Obtain legal advice” as a step of its own. Cybersmile says it does not give legal advice and points to law enforcement or a legal professional. The sources present a lawyer as an option.

On the law, Minc Law says there is no specific federal law against doxxing, that it is not explicitly unlawful in most jurisdictions, and that in the United States the rules vary by state. It names two federal statutes used in related cases, one on releasing the personal information of government officials or their families and one on using electronic communication to harass or intimidate, and says Nevada has passed a bill that prohibits doxxing and lets victims take civil action. We did not read those statutes; they are Minc Law’s description. It also says an address is generally considered public information, and that civil claims for invasion of privacy or emotional distress are possible, the second with a difficult standard.

For California, FindLaw prints Penal Code section 653.2, current as of 1 January 2026. It makes it a misdemeanor, punishable by up to one year in county jail, a fine of up to $1,000, or both, for publishing personal identifying information by means of an electronic communication device, without the other person’s consent, with intent to place that person in reasonable fear for safety or the safety of immediate family, and for the purpose of imminently causing unwanted physical contact, injury or harassment by a third party. That is narrower than Minc Law’s summary of it as cyber harassment with intent to harm, so for the wording we used the code itself. FindLaw adds that its codes may not reflect the most recent version and should be checked with the state legislature. This is not legal advice.

The last group of people is the ones around you. Minc Law suggests talking to someone you trust, taking a break from the internet, and, if you feel threatened at home, finding a safe place to stay, noting that law enforcement may suggest leaving. NYCLU suggests telling friends, peers and your supervisor or colleagues about the attacks, and documenting the experience. Cybersmile says only a fraction of people would have seen the content, which it offers as perspective, and says it does not offer telephone or crisis support. EFF puts it as keeping calm enough to make safe choices, with friends, a break, or whatever else keeps you afloat.

After the emergency: keeping the next one smaller

Several of the pages are mostly about prevention, and their lists overlap. Tufts and Berkeley both say to keep profiles and handles private, to leave your address and workplace out of them, and to hide your domain registration details from WHOIS; Berkeley adds a separate email address for financial and medical accounts, Tufts varied usernames and passwords. Cybersmile mentions a privacy package from the domain provider, or an alternative number such as Google Voice. NYCLU suggests searching for yourself with your phone number and first name, then last name, and with your address, to see how easy you are to find, and thinking about the GPS data saved in photos. Stanford IT’s news item points to a “Get Help With Doxxing” guide page, which we did not read. The wider work of finding and shrinking what is public is on our digital footprint page.

What we did not use

We tested nothing and sent no form to Google or to any platform. We did not read the Wikipedia article, the Malwarebytes page or the Fortinet glossary, and the Department of Homeland Security page leads to an infographic in PDF form that we did not read. We read only the announcement of Stanford’s guide, not the guide. Minc Law is a law firm that sells removal and reputation services, and we used its page only for facts, with its own wording attributed to it. It also quotes a 2022 study on how many Americans have been doxxed, which we left out.